The democracy-poll plugin prior to 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
wp-kama democracy poll